A naive approach to this problem is to exclude the sensitive variables from the policy's input.
However, it is well known [1]} that this approach will fail when correlations exist between the sensitive and non-sensitive state variables.
In the workplace scheduling example above, the policy may give shift assignments based on non-sensitive variables such as availability and performance which are correlated with medical status.
Solving our problem requires a careful consideration of the information disclosed by the policy's actions.
Furthermore, the possibility of feedback in the setting introduces additional complications: the agent may be able to take actions which render the sensitive state unimportant for decision making.
In the scheduling example, this could involve purchasing assistive equipment (at some cost) which allows employees to work regardless of medical condition. In general a privacy-aware agent may be able to achieve high reward while satisfying information disclosure constraints, compared to an agent that is entirely unaware of the sensitive state.
